@addai/node 0.30.10 → 0.30.12

package/dist/claude-print.js

@@ -12,6 +12,7 @@ const child_process_1 = require("child_process");
 const claude_binary_1 = require("./claude-binary");
 const win_1 = require("./win");
 const claude_system_prompt_1 = require("./claude-system-prompt");
+const prompt_transport_1 = require("./prompt-transport");
 /**
  * The text to emit for one flushed block, given what came before.
  *
@@ -175,17 +176,20 @@ function spawnClaudePrint(input) {
     // its node script instead (identity on POSIX). It can throw; so can
     // spawn() itself (synchronously, on win32). Surface either as a normal
     // rejected `done` so callers keep their single error path.
-    // An entity system prompt of tens of thousands of characters does not fit
-    // on a Windows command line — see claude-system-prompt.ts. No-op when it
-    // fits, which is every case that works today.
-    const sysPrompt = (0, claude_system_prompt_1.offloadLongSystemPrompt)(bin, args);
+    // One path, every run: the system prompt travels as a file and the user
+    // prompt down stdin, whatever their size. Size-dependent branches are where
+    // the ENAMETOOLONG failures hid — see prompt-transport.ts. The file form is
+    // gated only on this claude knowing the flag (probed once per binary).
+    const isWindows = process.platform === 'win32';
+    const sysPrompt = (0, claude_system_prompt_1.offloadLongSystemPrompt)(bin, args, isWindows, (0, claude_system_prompt_1.claudeSupportsPromptFile)(bin));
+    const transport = (0, prompt_transport_1.offloadLongPrompt)(bin, sysPrompt.args, sysPrompt.args.length - 1, null, isWindows, true);
     let proc;
     try {
-        const inv = (0, win_1.resolveCliInvocation)(bin, sysPrompt.args);
+        const inv = (0, win_1.resolveCliInvocation)(bin, transport.args);
         proc = (0, child_process_1.spawn)(inv.file, inv.args, {
             cwd: input.workingDirectory,
             env: { ...process.env, TERM: 'dumb' },
-            stdio: ['ignore', 'pipe', 'pipe'],
+            stdio: (0, prompt_transport_1.stdioFor)(transport.stdin),
             // No console window. This is headless work on somebody's machine —
             // on Windows a spawn without this flashes a terminal every run.
             windowsHide: true,
@@ -199,6 +203,7 @@ function spawnClaudePrint(input) {
         done.catch(() => { });
         return { pid: undefined, sessionId: null, kill: () => { }, onEvent: () => { }, done };
     }
+    (0, prompt_transport_1.feedStdin)(proc, transport.stdin);
     const listeners = [];
     const emit = (e) => { for (const l of listeners)
         try {

package/dist/claude-system-prompt.d.ts

@@ -1,3 +1,9 @@
+/** Head-room under the real 32,767 limit. Both node and node-pty escape quotes
+ *  and backslashes when they render argv into a command line, so what actually
+ *  reaches CreateProcess is longer than the sum of the arguments. */
+export declare const WINDOWS_BUDGET = 30000;
+/** POSIX only needs catching if a prompt has gone genuinely pathological. */
+export declare const POSIX_BUDGET = 120000;
 /** Rough rendered length of `file` + `args` as one command line. Counts two
  *  quotes and a separating space per argument — the shape a renderer uses for
  *  anything that might contain whitespace. */
@@ -15,4 +21,9 @@ export interface OffloadResult {
  * the temp file cannot be written — in that last case the spawn is left to
  * fail with its own error rather than a worse one invented here.
  */
-export declare function offloadLongSystemPrompt(file: string, args: string[], isWindows?: boolean): OffloadResult;
+export declare function offloadLongSystemPrompt(file: string, args: string[], isWindows?: boolean, 
+/** Move it regardless of size — the one-path rule (see prompt-transport.ts).
+ *  Callers pass claudeSupportsPromptFile(bin) so an older claude that does
+ *  not know the -file flag keeps the inline form. */
+force?: boolean): OffloadResult;
+export declare function claudeSupportsPromptFile(bin: string, probe?: (bin: string) => string): boolean;

package/dist/claude-system-prompt.js

@@ -14,6 +14,10 @@
 // --append-system-prompt-file. ONLY when it would not fit: the inline form is
 // what every working install uses today and an older claude may not know the
 // -file variant, so nothing that currently works changes shape.
+//
+// This only covers the system prompt. The USER prompt can be too long on its
+// own (a fresh session's context refresh carries the recent conversation);
+// prompt-transport.ts moves that one onto stdin, after this has run.
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -48,20 +52,24 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.POSIX_BUDGET = exports.WINDOWS_BUDGET = void 0;
 exports.commandLineLength = commandLineLength;
 exports.offloadLongSystemPrompt = offloadLongSystemPrompt;
+exports.claudeSupportsPromptFile = claudeSupportsPromptFile;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+const win_1 = require("./win");
 const INLINE_FLAG = '--append-system-prompt';
 const FILE_FLAG = '--append-system-prompt-file';
 /** Head-room under the real 32,767 limit. Both node and node-pty escape quotes
  *  and backslashes when they render argv into a command line, so what actually
  *  reaches CreateProcess is longer than the sum of the arguments. */
-const WINDOWS_BUDGET = 30_000;
+exports.WINDOWS_BUDGET = 30_000;
 /** POSIX only needs catching if a prompt has gone genuinely pathological. */
-const POSIX_BUDGET = 120_000;
+exports.POSIX_BUDGET = 120_000;
 /** Rough rendered length of `file` + `args` as one command line. Counts two
  *  quotes and a separating space per argument — the shape a renderer uses for
  *  anything that might contain whitespace. */
@@ -76,10 +84,14 @@ function commandLineLength(file, args) {
  * the temp file cannot be written — in that last case the spawn is left to
  * fail with its own error rather than a worse one invented here.
  */
-function offloadLongSystemPrompt(file, args, isWindows = process.platform === 'win32') {
+function offloadLongSystemPrompt(file, args, isWindows = process.platform === 'win32', 
+/** Move it regardless of size — the one-path rule (see prompt-transport.ts).
+ *  Callers pass claudeSupportsPromptFile(bin) so an older claude that does
+ *  not know the -file flag keeps the inline form. */
+force = false) {
     const noop = { args, cleanup: () => { } };
-    const budget = isWindows ? WINDOWS_BUDGET : POSIX_BUDGET;
-    if (commandLineLength(file, args) <= budget)
+    const budget = isWindows ? exports.WINDOWS_BUDGET : exports.POSIX_BUDGET;
+    if (!force && commandLineLength(file, args) <= budget)
         return noop;
     const i = args.indexOf(INLINE_FLAG);
     if (i < 0 || i + 1 >= args.length)
@@ -108,3 +120,35 @@ function offloadLongSystemPrompt(file, args, isWindows = process.platform === 'w
         },
     };
 }
+/**
+ * Does this claude know --append-system-prompt-file? Asked once per binary
+ * and remembered for the life of the daemon. The answer decides whether the
+ * system prompt ALWAYS travels as a file — one path, exercised by every run —
+ * or only when it would not fit inline, the old rare path kept for a claude
+ * too old to know the flag. A probe that fails answers "no", which is the
+ * behaviour every working install had before.
+ */
+const promptFileSupport = new Map();
+function claudeSupportsPromptFile(bin, probe = claudeHelpText) {
+    const cached = promptFileSupport.get(bin);
+    if (cached !== undefined)
+        return cached;
+    let ok = false;
+    // claude's own help lists the pair as `--append-system-prompt[-file]`, so a
+    // literal search for the long flag would say no to a claude that knows it.
+    try {
+        const help = probe(bin);
+        ok = help.includes(FILE_FLAG) || help.includes('--append-system-prompt[-file]');
+    }
+    catch {
+        ok = false;
+    }
+    promptFileSupport.set(bin, ok);
+    return ok;
+}
+function claudeHelpText(bin) {
+    const inv = (0, win_1.resolveCliInvocation)(bin, ['--help']);
+    return (0, child_process_1.execFileSync)(inv.file, inv.args, {
+        encoding: 'utf8', timeout: 20_000, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'],
+    });
+}

package/dist/codex-spawn.d.ts

@@ -25,14 +25,43 @@ export interface CodexInput {
      *  Mirrors the claude --strict-mcp-config behavior. */
     mcpServers?: CodexMcpServer[];
 }
+export interface CodexHomeOptions {
+    /** Forward a remote server's credentials as headers via env_http_headers.
+     *  spawnCodex passes codexSupportsEnvHttpHeaders(bin), so a codex too old to
+     *  know the key keeps exactly the config it had before. Default true. */
+    envHttpHeaders?: boolean;
+}
 /** Build a config.toml that declares only the supplied MCP servers and
  *  return the CODEX_HOME directory plus any env vars the child needs
- *  (bearer tokens for remote servers). Caller is responsible for cleanup
- *  (we drop it under os.tmpdir() so it gets reaped). */
-export declare function writeCodexHome(servers: CodexMcpServer[], workingDirectory: string): {
+ *  (bearer tokens and header values for remote servers). Caller is
+ *  responsible for cleanup (we drop it under os.tmpdir() so it gets reaped). */
+export declare function writeCodexHome(servers: CodexMcpServer[], workingDirectory: string, opts?: CodexHomeOptions): {
     home: string;
     extraEnv: Record<string, string>;
 };
+/**
+ * Does this codex know env_http_headers? Asked by having it parse a throwaway
+ * config (`codex mcp list --json`, which reads config and contacts nothing)
+ * and checking that the header survived. Remembered per binary. Any failure
+ * answers "no", which keeps the bearer-only config every install ran before.
+ */
+export declare function codexSupportsEnvHttpHeaders(bin: string, probe?: (bin: string, codexHome: string) => string): boolean;
+/** Read `codex mcp list --json` output: did the probe server's header survive?
+ *  Exported for tests. */
+export declare function codexListShowsEnvHeaders(stdout: string): boolean;
+/** First line of an AGENTS.md this daemon wrote. A project's own AGENTS.md
+ *  never carries it and is never touched. */
+export declare const AGENTS_MD_MARKER = "<!-- ainode: entity system prompt \u2014 rewritten before every turn; edits here do not persist -->";
+/**
+ * Put the entity's system prompt where codex natively looks for guidance:
+ * AGENTS.md in the working directory. codex has no --append-system-prompt,
+ * and gluing 30K characters of persona onto every user turn was the
+ * alternative. Returns false — and writes nothing — when the folder already
+ * has an AGENTS.md that is not ours, so a chat bound to a real repository
+ * can never have its project file overwritten; the caller then falls back to
+ * the glued form.
+ */
+export declare function writeCodexAgentsMd(workingDirectory: string, systemPrompt: string): boolean;
 export interface CodexHandle {
     pid: number | undefined;
     threadId: string | null;

package/dist/codex-spawn.js

@@ -40,7 +40,11 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENTS_MD_MARKER = void 0;
 exports.writeCodexHome = writeCodexHome;
+exports.codexSupportsEnvHttpHeaders = codexSupportsEnvHttpHeaders;
+exports.codexListShowsEnvHeaders = codexListShowsEnvHeaders;
+exports.writeCodexAgentsMd = writeCodexAgentsMd;
 exports.codexEffort = codexEffort;
 exports.spawnCodex = spawnCodex;
 const child_process_1 = require("child_process");
@@ -52,6 +56,8 @@ const codex_binary_1 = require("./codex-binary");
 const diskguard_1 = require("./diskguard");
 const win_1 = require("./win");
 const events_1 = require("./events");
+const prompt_transport_1 = require("./prompt-transport");
+const mcp_headers_1 = require("./mcp-headers");
 /** Quote a string as a TOML basic string (double-quoted, escape backslash + quote). */
 function tomlString(s) {
     return '"' + String(s).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n') + '"';
@@ -60,11 +66,17 @@ function tomlString(s) {
  *  Only the NAME goes in config.toml — the value rides on the child env, so
  *  the token never lands on disk. */
 const bearerEnvVar = (slug) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}_TOKEN`;
+/** Env var name carrying one HTTP header's value into the codex process.
+ *  config.toml references it by name via env_http_headers, so the value never
+ *  lands on disk either. */
+const headerEnvVar = (slug, header) => `AINODE_MCP_${slug.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}` +
+    `_H_${header.replace(/[^A-Za-z0-9]+/g, '_').toUpperCase()}`;
 /** Build a config.toml that declares only the supplied MCP servers and
  *  return the CODEX_HOME directory plus any env vars the child needs
- *  (bearer tokens for remote servers). Caller is responsible for cleanup
- *  (we drop it under os.tmpdir() so it gets reaped). */
-function writeCodexHome(servers, workingDirectory) {
+ *  (bearer tokens and header values for remote servers). Caller is
+ *  responsible for cleanup (we drop it under os.tmpdir() so it gets reaped). */
+function writeCodexHome(servers, workingDirectory, opts = {}) {
+    const envHttpHeaders = opts.envHttpHeaders !== false;
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'entities-codex-'));
     const extraEnv = {};
     let toml = '# Generated by ainode — sandboxes codex against host config\n\n';
@@ -89,6 +101,8 @@ function writeCodexHome(servers, workingDirectory) {
             toml += `url = ${tomlString(url)}\n`;
             // codex reads the bearer from its OWN environment (--env is stdio-only),
             // so the value goes on the child env and only the var name in the file.
+            // The bearer is exactly what this adapter always sent, kept so anything
+            // that works on codex today keeps working.
             const creds = Object.entries(s.env || {})
                 .filter(([k, v]) => typeof v === 'string' && v.length > 0 && !k.startsWith('OAUTH_REFRESH'));
             const bearer = creds.find(([k]) => k === 'OAUTH_ACCESS_TOKEN') ?? creds[0];
@@ -96,15 +110,34 @@ function writeCodexHome(servers, workingDirectory) {
                 const varName = bearerEnvVar(s.slug);
                 extraEnv[varName] = String(bearer[1]);
                 toml += `bearer_token_env_var = ${tomlString(varName)}\n`;
-                if (creds.length > 1) {
-                    // codex carries one bearer and no arbitrary headers. Anything that
-                    // authenticates with several custom headers is only partly wired,
-                    // and saying so beats a server that 401s for no visible reason.
-                    console.error(`[codex] MCP ${s.slug}: only ${bearer[0]} is forwarded as a bearer token; ` +
-                        `codex cannot send custom headers, so ${creds.length - 1} other credential ` +
-                        `field(s) were dropped`);
+            }
+            // The bearer alone was never enough. The servers read each credential
+            // from its own header (the claude path sends them all, see
+            // remoteMcpHeaders) and fall back to the bearer for any that is missing,
+            // so +Ai Drive, which carries three, used its API key as its workspace
+            // id and answered "Access denied to workspace" on every codex run.
+            // codex does send custom headers: env_http_headers maps a header name to
+            // the NAME of an env var, so the values stay off disk like the bearer.
+            const headers = (0, mcp_headers_1.remoteMcpHeaders)(s.env);
+            // An OAuth access token is already the bearer above.
+            delete headers.Authorization;
+            const entries = Object.entries(headers);
+            if (entries.length > 0 && envHttpHeaders) {
+                // A sub-table must follow the parent table's scalar keys.
+                toml += `[mcp_servers.${name}.env_http_headers]\n`;
+                for (const [header, value] of entries) {
+                    const varName = headerEnvVar(s.slug, header);
+                    extraEnv[varName] = value;
+                    toml += `${tomlString(header)} = ${tomlString(varName)}\n`;
                 }
             }
+            else if (creds.length > 1) {
+                // A codex too old to know env_http_headers carries the bearer only.
+                // Saying so beats a server that refuses for no visible reason.
+                console.error(`[codex] MCP ${s.slug}: this codex cannot send custom headers, so only ` +
+                    `${bearer?.[0]} is forwarded and ${creds.length - 1} other credential ` +
+                    `field(s) were dropped`);
+            }
             toml += '\n';
             continue;
         }
@@ -156,6 +189,103 @@ function writeCodexHome(servers, workingDirectory) {
     }
     return { home: dir, extraEnv };
 }
+const PROBE_SERVER = 'ainode_probe';
+const PROBE_HEADER = 'X-Ainode-Probe';
+// A real answer holds until the binary might have been updated; a probe that
+// could not run at all is retried sooner.
+const PROBE_TTL_MS = 6 * 60 * 60 * 1000;
+const PROBE_FAILED_TTL_MS = 10 * 60 * 1000;
+const envHeaderSupport = new Map();
+/**
+ * Does this codex know env_http_headers? Asked by having it parse a throwaway
+ * config (`codex mcp list --json`, which reads config and contacts nothing)
+ * and checking that the header survived. Remembered per binary. Any failure
+ * answers "no", which keeps the bearer-only config every install ran before.
+ */
+function codexSupportsEnvHttpHeaders(bin, probe = codexMcpListJson) {
+    const hit = envHeaderSupport.get(bin);
+    if (hit && hit.until > Date.now())
+        return hit.ok;
+    let ok = false;
+    let failed = false;
+    let home = null;
+    try {
+        home = fs.mkdtempSync(path.join(os.tmpdir(), 'ainode-codex-probe-'));
+        fs.writeFileSync(path.join(home, 'config.toml'), `[mcp_servers.${PROBE_SERVER}]\n` +
+            `url = "http://127.0.0.1:9/mcp"\n` +
+            // A bearer keeps codex from looking for stored OAuth credentials.
+            `bearer_token_env_var = "AINODE_PROBE_TOKEN"\n` +
+            `[mcp_servers.${PROBE_SERVER}.env_http_headers]\n` +
+            `"${PROBE_HEADER}" = "AINODE_PROBE_HEADER"\n`, { mode: 0o600 });
+        ok = codexListShowsEnvHeaders(probe(bin, home));
+    }
+    catch {
+        ok = false;
+        failed = true;
+    }
+    finally {
+        if (home) {
+            try {
+                fs.rmSync(home, { recursive: true, force: true });
+            }
+            catch { /* reaped from tmp */ }
+        }
+    }
+    envHeaderSupport.set(bin, { ok, until: Date.now() + (failed ? PROBE_FAILED_TTL_MS : PROBE_TTL_MS) });
+    return ok;
+}
+/** Read `codex mcp list --json` output: did the probe server's header survive?
+ *  Exported for tests. */
+function codexListShowsEnvHeaders(stdout) {
+    const start = stdout.search(/^\s*\[/m);
+    if (start < 0)
+        return false;
+    let list;
+    try {
+        list = JSON.parse(stdout.slice(start));
+    }
+    catch {
+        return false;
+    }
+    if (!Array.isArray(list))
+        return false;
+    const entry = list.find((e) => e && e.name === PROBE_SERVER);
+    return entry?.transport?.env_http_headers?.[PROBE_HEADER] === 'AINODE_PROBE_HEADER';
+}
+function codexMcpListJson(bin, codexHome) {
+    const inv = (0, win_1.resolveCliInvocation)(bin, ['mcp', 'list', '--json']);
+    return (0, child_process_1.execFileSync)(inv.file, inv.args, {
+        encoding: 'utf8', timeout: 20_000, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'],
+        env: { ...process.env, CODEX_HOME: codexHome },
+    });
+}
+/** First line of an AGENTS.md this daemon wrote. A project's own AGENTS.md
+ *  never carries it and is never touched. */
+exports.AGENTS_MD_MARKER = '<!-- ainode: entity system prompt — rewritten before every turn; edits here do not persist -->';
+/**
+ * Put the entity's system prompt where codex natively looks for guidance:
+ * AGENTS.md in the working directory. codex has no --append-system-prompt,
+ * and gluing 30K characters of persona onto every user turn was the
+ * alternative. Returns false — and writes nothing — when the folder already
+ * has an AGENTS.md that is not ours, so a chat bound to a real repository
+ * can never have its project file overwritten; the caller then falls back to
+ * the glued form.
+ */
+function writeCodexAgentsMd(workingDirectory, systemPrompt) {
+    const target = path.join(workingDirectory, 'AGENTS.md');
+    try {
+        if (fs.existsSync(target)) {
+            const head = fs.readFileSync(target, 'utf8').slice(0, exports.AGENTS_MD_MARKER.length + 16);
+            if (!head.includes(exports.AGENTS_MD_MARKER))
+                return false;
+        }
+        fs.writeFileSync(target, `${exports.AGENTS_MD_MARKER}\n\n${systemPrompt.trim()}\n`, 'utf8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function lineToEvents(line) {
     const type = typeof line.type === 'string' ? line.type : '';
     // Errors come as { type: 'error', message: string } — surface them.
@@ -221,6 +351,10 @@ function spawnCodex(input) {
     // `exec` command, before the `resume` subcommand. Putting them after
     // resume returns "unexpected argument" and exits 2.
     const baseFlags = ['--cd', input.workingDirectory, '--json'];
+    // AGENTS.md in the working directory carries the entity's system prompt (see
+    // writeCodexAgentsMd). codex truncates project docs at 32 KiB by default,
+    // which a persona plus its app instructions routinely exceeds.
+    baseFlags.push('-c', 'project_doc_max_bytes=262144');
     if (input.skipGitRepoCheck)
         baseFlags.push('--skip-git-repo-check');
     if (input.bypassPermissions)
@@ -236,10 +370,19 @@ function spawnCodex(input) {
     const args = input.resumeThreadId
         ? ['exec', ...baseFlags, 'resume', input.resumeThreadId, input.prompt]
         : ['exec', ...baseFlags, input.prompt];
+    // Resolve binary path before spawn. Previously called spawn('codex', ...)
+    // bare, which threw ENOENT under launchd / desktop-app PATH inheritance
+    // and rejected `done` before any session_end event fired → request
+    // stuck at 'running' on the DB. Resolved first now, because the config
+    // below depends on what this codex understands.
+    const bin = (0, codex_binary_1.findCodexBinary)();
     // Sandbox codex against an isolated CODEX_HOME so the host's
     // ~/.codex/config.toml mcp_servers don't leak in. TERM=dumb keeps
     // codex's TTY heuristics happy (no fancy terminal output).
-    const { home: codexHome, extraEnv: mcpBearerEnv } = writeCodexHome(input.mcpServers ?? [], input.workingDirectory);
+    const servers = input.mcpServers ?? [];
+    // Only a remote server that carries credentials needs the header probe.
+    const wantsHeaders = servers.some((s) => (0, mcp_headers_1.isRemoteMcp)(s.command) && Object.keys(s.env ?? {}).length > 0);
+    const { home: codexHome, extraEnv: mcpBearerEnv } = writeCodexHome(servers, input.workingDirectory, { envHttpHeaders: wantsHeaders && bin ? codexSupportsEnvHttpHeaders(bin) : false });
     // Register the scratch dir with DiskGuard: marks it active (so a
     // concurrent sweep won't evict a live run) and writes a PID lock so a
     // different runtime process can tell it's still owned. dispose(true)
@@ -250,15 +393,11 @@ function spawnCodex(input) {
         ...process.env,
         TERM: 'dumb',
         CODEX_HOME: codexHome,
-        // Bearer tokens for remote (http/sse) MCP servers. config.toml names these
-        // vars via bearer_token_env_var; the values only ever live here.
+        // Bearer tokens and header values for remote (http/sse) MCP servers.
+        // config.toml names these vars via bearer_token_env_var and
+        // env_http_headers; the values only ever live here.
         ...mcpBearerEnv,
     };
-    // Resolve binary path before spawn. Previously called spawn('codex', ...)
-    // bare, which threw ENOENT under launchd / desktop-app PATH inheritance
-    // and rejected `done` before any session_end event fired → request
-    // stuck at 'running' on the DB.
-    const bin = (0, codex_binary_1.findCodexBinary)();
     const listeners = [];
     const emit = (e) => { for (const l of listeners)
         try {
@@ -292,15 +431,18 @@ function spawnCodex(input) {
             kill() { },
         };
     }
+    // One path, every run: the prompt goes down stdin (`codex exec -`, fresh and
+    // resume forms alike) whatever its size. See prompt-transport.ts.
+    const transport = (0, prompt_transport_1.offloadLongPrompt)(bin, args, args.length - 1, '-', process.platform === 'win32', true);
     let proc;
     try {
         // npm .cmd shim → node script (win32); identity on POSIX. Throws on an
         // unresolvable shim — caught below alongside spawn's own sync errors.
-        const inv = (0, win_1.resolveCliInvocation)(bin, args);
+        const inv = (0, win_1.resolveCliInvocation)(bin, transport.args);
         proc = (0, child_process_1.spawn)(inv.file, inv.args, {
             cwd: input.workingDirectory,
             env: childEnv,
-            stdio: ['ignore', 'pipe', 'pipe'],
+            stdio: (0, prompt_transport_1.stdioFor)(transport.stdin),
             // No console window. This is headless work on somebody's machine —
             // on Windows a spawn without this flashes a terminal every run.
             windowsHide: true,
@@ -322,6 +464,7 @@ function spawnCodex(input) {
             kill() { },
         };
     }
+    (0, prompt_transport_1.feedStdin)(proc, transport.stdin);
     // Models do not reliably keep reasoning on their own stream — they drop
     // back to ordinary text mid-run and carry on thinking inside a <think>
     // tag. Split it back out before it reaches the room. See think-split.ts.

package/dist/context-files.d.ts

@@ -0,0 +1,29 @@
+/** The one folder we write into. */
+export declare const CONTEXT_DIR = "context";
+export interface ContextFilesResult {
+    /** Relative paths written, in the order they arrived. */
+    written: string[];
+    /** Relative paths refused or failed, with the reason. */
+    skipped: Array<{
+        path: string;
+        reason: string;
+    }>;
+}
+/**
+ * Validate `files` as a {relative path: markdown} object. Pure; exported for tests.
+ * Returns the entries that may be written and the ones that were refused.
+ */
+export declare function planContextFiles(files: unknown): {
+    ok: Array<[string, string]>;
+    refused: Array<{
+        path: string;
+        reason: string;
+    }>;
+};
+/**
+ * Write the context files into `cwd`. Never throws.
+ *
+ * Existing files are replaced whole: each turn carries the current picture of
+ * the conversation, and a stale conversation.md is worse than none.
+ */
+export declare function writeContextFiles(cwd: string, files: unknown): ContextFilesResult;

package/dist/context-files.js

@@ -0,0 +1,150 @@
+"use strict";
+// Context files: depth the entity can read when it needs it.
+//
+// The dispatcher keeps the inline briefing small — who, where, what has
+// happened here since the last turn — and puts the deeper material into a few
+// markdown files under context/ in the run's working folder: the last 50
+// messages of the conversation, a card about the sender, a card about the
+// chat. They cost nothing until the entity opens one, and every agent CLI can
+// read a local file without a network round trip.
+//
+// The files arrive on the request row as `context_files`: a JSON object of
+// relative path → markdown. Only plain names under context/ are accepted, so a
+// row can never write outside the folder or clobber the agent's own files.
+// The folder is marked as ours on creation (context/.ainode) and ignored by
+// git (context/.gitignore): a chat bound to a real project directory must
+// never gain stray files in the repo, and a project that already HAS a
+// context/ folder of its own is left completely alone.
+//
+// Everything here is best-effort: the inline briefing is complete on its own,
+// so a write failure must never block a turn — it just means the pointer in
+// the prompt leads to a missing file, which the agent reports and moves on.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONTEXT_DIR = void 0;
+exports.planContextFiles = planContextFiles;
+exports.writeContextFiles = writeContextFiles;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** The one folder we write into. */
+exports.CONTEXT_DIR = 'context';
+/** Present only in a context/ folder this daemon created. */
+const OWNER_MARKER = '.ainode';
+/** Relative paths we will write: context/<name>.md, one level, safe characters only. */
+const ALLOWED = /^context\/[A-Za-z0-9][A-Za-z0-9._-]{0,80}\.md$/;
+/** No single file beyond this; the dispatcher caps well under it. */
+const MAX_FILE_CHARS = 200_000;
+/**
+ * Validate `files` as a {relative path: markdown} object. Pure; exported for tests.
+ * Returns the entries that may be written and the ones that were refused.
+ */
+function planContextFiles(files) {
+    const ok = [];
+    const refused = [];
+    if (!files || typeof files !== 'object' || Array.isArray(files))
+        return { ok, refused };
+    for (const [rel, body] of Object.entries(files)) {
+        if (!ALLOWED.test(rel)) {
+            refused.push({ path: rel, reason: 'path not allowed' });
+            continue;
+        }
+        if (typeof body !== 'string') {
+            refused.push({ path: rel, reason: 'content is not text' });
+            continue;
+        }
+        if (body.length > MAX_FILE_CHARS) {
+            refused.push({ path: rel, reason: `over ${MAX_FILE_CHARS} chars` });
+            continue;
+        }
+        ok.push([rel, body]);
+    }
+    return { ok, refused };
+}
+/**
+ * Make sure `<cwd>/context/` exists and is ours. Returns a reason to refuse,
+ * or null when it is safe to write there.
+ */
+function claimContextDir(cwd) {
+    const dir = path.join(cwd, exports.CONTEXT_DIR);
+    const marker = path.join(dir, OWNER_MARKER);
+    try {
+        if (fs.existsSync(dir)) {
+            if (!fs.statSync(dir).isDirectory())
+                return `${exports.CONTEXT_DIR} exists and is not a directory`;
+            if (!fs.existsSync(marker))
+                return `${exports.CONTEXT_DIR}/ already exists and was not created by the node`;
+            return null;
+        }
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(marker, 'This folder is written by the +Ai Node before every turn. Edits here do not persist.\n');
+        fs.writeFileSync(path.join(dir, '.gitignore'), '*\n');
+        return null;
+    }
+    catch (err) {
+        return err.message;
+    }
+}
+/**
+ * Write the context files into `cwd`. Never throws.
+ *
+ * Existing files are replaced whole: each turn carries the current picture of
+ * the conversation, and a stale conversation.md is worse than none.
+ */
+function writeContextFiles(cwd, files) {
+    const plan = planContextFiles(files);
+    const result = { written: [], skipped: [...plan.refused] };
+    if (plan.ok.length === 0)
+        return result;
+    const refusal = claimContextDir(cwd);
+    if (refusal) {
+        for (const [rel] of plan.ok)
+            result.skipped.push({ path: rel, reason: refusal });
+        return result;
+    }
+    for (const [rel, body] of plan.ok) {
+        const abs = path.join(cwd, rel);
+        try {
+            // Write beside, then rename: a reader never sees a half-written file.
+            const tmp = `${abs}.${process.pid}.tmp`;
+            fs.writeFileSync(tmp, body, 'utf8');
+            fs.renameSync(tmp, abs);
+            result.written.push(rel);
+        }
+        catch (err) {
+            result.skipped.push({ path: rel, reason: err.message });
+        }
+    }
+    return result;
+}

package/dist/gemini-spawn.js

@@ -54,6 +54,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const gemini_binary_1 = require("./gemini-binary");
 const win_1 = require("./win");
+const prompt_transport_1 = require("./prompt-transport");
 const events_1 = require("./events");
 const think_split_1 = require("./think-split");
 const mcp_headers_1 = require("./mcp-headers");
@@ -352,6 +353,10 @@ function spawnGemini(input) {
         // npm .cmd shim → node script (win32); identity on POSIX. Both this
         // resolution and spawn() itself can throw synchronously on Windows —
         // fail the request cleanly instead of crashing the daemon.
+        // Not yet verified to read the prompt from stdin, so it stays inline — and
+        // an oversized command line is refused here with a reason, instead of by
+        // the OS with a bare errno. See prompt-transport.ts.
+        (0, prompt_transport_1.assertCommandLineFits)('gemini', bin, args);
         const inv = (0, win_1.resolveCliInvocation)(bin, args);
         proc = (0, child_process_1.spawn)(inv.file, inv.args, {
             cwd: input.workingDirectory,

package/dist/grok-spawn.js

@@ -72,6 +72,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const grok_binary_1 = require("./grok-binary");
 const win_1 = require("./win");
+const prompt_transport_1 = require("./prompt-transport");
 const events_1 = require("./events");
 const think_split_1 = require("./think-split");
 /** Real config dir for the logged-in account. GROK_HOME points here so the
@@ -344,6 +345,10 @@ function spawnGrok(input) {
         // npm .cmd shim → node script (win32); identity on POSIX. Both this
         // resolution and spawn() itself can throw synchronously on Windows —
         // fail the request cleanly instead of crashing the daemon.
+        // Not yet verified to read the prompt from stdin, so it stays inline — and
+        // an oversized command line is refused here with a reason, instead of by
+        // the OS with a bare errno. See prompt-transport.ts.
+        (0, prompt_transport_1.assertCommandLineFits)('grok', bin, args);
         const inv = (0, win_1.resolveCliInvocation)(bin, args);
         proc = (0, child_process_1.spawn)(inv.file, inv.args, {
             cwd: input.workingDirectory,

package/dist/kimi-spawn.js

@@ -70,6 +70,7 @@ const path = __importStar(require("path"));
 const kimi_binary_1 = require("./kimi-binary");
 const harness_registry_1 = require("./harness-registry");
 const win_1 = require("./win");
+const prompt_transport_1 = require("./prompt-transport");
 const events_1 = require("./events");
 const think_split_1 = require("./think-split");
 const mcp_headers_1 = require("./mcp-headers");
@@ -385,6 +386,10 @@ function spawnKimi(input) {
         // npm .cmd shim → node script (win32); identity on POSIX. Both this
         // resolution and spawn() itself can throw synchronously on Windows —
         // fail the request cleanly instead of crashing the daemon.
+        // Not yet verified to read the prompt from stdin, so it stays inline — and
+        // an oversized command line is refused here with a reason, instead of by
+        // the OS with a bare errno. See prompt-transport.ts.
+        (0, prompt_transport_1.assertCommandLineFits)('kimi', bin, args);
         const inv = (0, win_1.resolveCliInvocation)(bin, args);
         proc = (0, child_process_1.spawn)(inv.file, inv.args, {
             cwd: input.workingDirectory,

package/dist/prompt-transport.d.ts

@@ -0,0 +1,47 @@
+import type { ChildProcess } from 'child_process';
+export interface PromptTransport {
+    /** argv to spawn with. The very same array when nothing moved. */
+    args: string[];
+    /** Text to write to the child's stdin and then close it. null = nothing
+     *  moved; leave stdin ignored exactly as before. */
+    stdin: string | null;
+}
+/**
+ * Take the prompt at `promptIndex` off the command line.
+ *
+ * With `force` the prompt always moves (the one-path rule). Without it, it
+ * moves only when the rendered command line would not fit the platform's
+ * budget — the original behaviour, kept for callers that have no stdin route.
+ *
+ * `placeholder` is what the CLI wants left in the prompt's place: `'-'` for
+ * codex, `null` for claude (which reads stdin only when given no prompt).
+ */
+export declare function offloadLongPrompt(file: string, args: string[], promptIndex: number, placeholder: string | null, isWindows?: boolean, force?: boolean): PromptTransport;
+/** stdio for spawn(): a pipe for stdin only when there is a prompt to feed. */
+export declare function stdioFor(stdin: string | null): ['pipe' | 'ignore', 'pipe', 'pipe'];
+/**
+ * Write the offloaded prompt to the child's stdin and close it, so the CLI
+ * sees EOF and starts. A child that exits before reading (bad binary, an
+ * immediate crash) turns the write into EPIPE; that outcome already surfaces
+ * through the process's own exit/error path, so the stream error is swallowed
+ * here rather than escaping as an unhandled 'error' event that would take the
+ * whole daemon down with it.
+ */
+export declare function feedStdin(proc: Pick<ChildProcess, 'stdin'>, text: string | null): void;
+/**
+ * Would this command line be refused by the operating system? Returns a plain
+ * sentence naming the limit that would be hit, or null when it fits.
+ *
+ * The limits differ in kind, not just size: Windows caps the WHOLE command
+ * line (32,767 characters, CreateProcess); Linux caps each SINGLE argument
+ * (131,072 bytes, MAX_ARG_STRLEN) and the total at a generous 2 MB; macOS caps
+ * the total including the environment at 1 MB, so 900,000 leaves room for it.
+ */
+export declare function commandLineProblem(file: string, args: string[], platform?: NodeJS.Platform): string | null;
+/**
+ * Refuse, with a reason a person can act on, before the OS refuses with an
+ * errno. For launchers whose stdin route is not yet verified. The throw lands
+ * in the launcher's existing spawn-failure path, so the provider ladder still
+ * moves on to an agent that can take the prompt.
+ */
+export declare function assertCommandLineFits(agent: string, file: string, args: string[], platform?: NodeJS.Platform): void;

package/dist/prompt-transport.js

@@ -0,0 +1,121 @@
+"use strict";
+// How a prompt reaches an agent: one path, used on every run.
+//
+// claude-system-prompt.ts moved an oversized --append-system-prompt into a
+// file, and that was enough for Hannah, whose USER prompt was small. It was
+// not enough for Brenda on 10 Sep 2026: a fresh session opened with a
+// "context refresh" plus a global activity diary inside the user prompt —
+// 36,421 characters for one DM, 67,658 for another — and that single argument
+// was on its own over CreateProcess's 32,767-character limit. claude died with
+// `spawn ENAMETOOLONG`, the provider ladder hopped to codex, whose command
+// line carried the system prompt AND the user prompt as one argument, and
+// codex died the same way. The entity posted "spawn ENAMETOOLONG" twice and
+// the run dead-lettered.
+//
+// The rare route is where that bug hid: a size-dependent branch nobody had
+// exercised for the user prompt. So the prompt now ALWAYS goes down the
+// child's stdin for the launchers that read it there — `claude --print` when
+// given no positional prompt, `codex exec` (and `codex exec resume <id>`)
+// when the prompt is `-`. Both were verified on Windows on 10 Sep 2026. Size
+// stops being a thing that can decide whether an entity starts, and the path
+// is tested by every normal turn instead of by the one that overflows.
+//
+// The `force` flag is what makes the route unconditional; without it the
+// helper keeps its original "only when it would not fit" behaviour, which is
+// what the TUI path still uses. Launchers that have NOT been verified to read
+// stdin (grok, kimi, gemini) keep the inline form and get assertCommandLineFits
+// instead: a refusal that names the oversized argument, in place of a bare
+// errno from the OS.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.offloadLongPrompt = offloadLongPrompt;
+exports.stdioFor = stdioFor;
+exports.feedStdin = feedStdin;
+exports.commandLineProblem = commandLineProblem;
+exports.assertCommandLineFits = assertCommandLineFits;
+const claude_system_prompt_1 = require("./claude-system-prompt");
+/**
+ * Take the prompt at `promptIndex` off the command line.
+ *
+ * With `force` the prompt always moves (the one-path rule). Without it, it
+ * moves only when the rendered command line would not fit the platform's
+ * budget — the original behaviour, kept for callers that have no stdin route.
+ *
+ * `placeholder` is what the CLI wants left in the prompt's place: `'-'` for
+ * codex, `null` for claude (which reads stdin only when given no prompt).
+ */
+function offloadLongPrompt(file, args, promptIndex, placeholder, isWindows = process.platform === 'win32', force = false) {
+    const noop = { args, stdin: null };
+    if (promptIndex < 0 || promptIndex >= args.length)
+        return noop;
+    if (!force) {
+        const budget = isWindows ? claude_system_prompt_1.WINDOWS_BUDGET : claude_system_prompt_1.POSIX_BUDGET;
+        if ((0, claude_system_prompt_1.commandLineLength)(file, args) <= budget)
+            return noop;
+    }
+    const prompt = args[promptIndex];
+    const next = args.slice();
+    if (placeholder === null)
+        next.splice(promptIndex, 1);
+    else
+        next[promptIndex] = placeholder;
+    return { args: next, stdin: prompt };
+}
+/** stdio for spawn(): a pipe for stdin only when there is a prompt to feed. */
+function stdioFor(stdin) {
+    return [stdin === null ? 'ignore' : 'pipe', 'pipe', 'pipe'];
+}
+/**
+ * Write the offloaded prompt to the child's stdin and close it, so the CLI
+ * sees EOF and starts. A child that exits before reading (bad binary, an
+ * immediate crash) turns the write into EPIPE; that outcome already surfaces
+ * through the process's own exit/error path, so the stream error is swallowed
+ * here rather than escaping as an unhandled 'error' event that would take the
+ * whole daemon down with it.
+ */
+function feedStdin(proc, text) {
+    if (text === null)
+        return;
+    const stdin = proc.stdin;
+    if (!stdin)
+        return;
+    stdin.on('error', () => { });
+    stdin.end(text, 'utf8');
+}
+/**
+ * Would this command line be refused by the operating system? Returns a plain
+ * sentence naming the limit that would be hit, or null when it fits.
+ *
+ * The limits differ in kind, not just size: Windows caps the WHOLE command
+ * line (32,767 characters, CreateProcess); Linux caps each SINGLE argument
+ * (131,072 bytes, MAX_ARG_STRLEN) and the total at a generous 2 MB; macOS caps
+ * the total including the environment at 1 MB, so 900,000 leaves room for it.
+ */
+function commandLineProblem(file, args, platform = process.platform) {
+    const total = (0, claude_system_prompt_1.commandLineLength)(file, args);
+    const longest = args.reduce((m, a) => Math.max(m, a.length), 0);
+    if (platform === 'win32') {
+        return total > 32_767
+            ? `the command line would be ${total} characters and Windows allows 32,767`
+            : null;
+    }
+    if (platform === 'linux' && longest > 131_072) {
+        return `one argument would be ${longest} characters and Linux allows 131,072 per argument`;
+    }
+    if (total > 900_000) {
+        return `the command line would be ${total} characters and this OS allows about 1,000,000 including the environment`;
+    }
+    return null;
+}
+/**
+ * Refuse, with a reason a person can act on, before the OS refuses with an
+ * errno. For launchers whose stdin route is not yet verified. The throw lands
+ * in the launcher's existing spawn-failure path, so the provider ladder still
+ * moves on to an agent that can take the prompt.
+ */
+function assertCommandLineFits(agent, file, args, platform = process.platform) {
+    const problem = commandLineProblem(file, args, platform);
+    if (!problem)
+        return;
+    throw new Error(`${agent} cannot be started: ${problem}. The prompt is too long to pass on the command line ` +
+        `and this launcher does not yet read it from stdin; the provider ladder will try the next agent.`);
+}

package/dist/session-runner.d.ts

@@ -60,6 +60,8 @@ export interface RuntimeRequestRow {
      *  tokens before SKILL.md is written. Optional — older rows omit it and
      *  the daemon defaults to {} (no substitution beyond skill defaults). */
     skill_var_values?: Record<string, Record<string, string>> | null;
+    /** Conversation context files {relative path: markdown} to write into cwd before spawn (context-files.ts). */
+    context_files?: Record<string, string> | null;
     /** Self-improve flag for autonomous entities. When truthy AND the run
      *  reaches a `completed` terminal status, the daemon fires a best-effort
      *  POST to the `entity-self-improve` edge function so the entity can

package/dist/session-runner.js

@@ -75,6 +75,7 @@ const hang_watchdog_1 = require("./hang-watchdog");
 const install_1 = require("./install");
 const memory_capture_1 = require("./memory-capture");
 const memory_pack_1 = require("./memory-pack");
+const context_files_1 = require("./context-files");
 const guardrails_1 = require("./guardrails");
 const time_context_1 = require("./time-context");
 // Idle window after the LAST mid-turn event before we declare the turn
@@ -1676,7 +1677,15 @@ async function runCodex(req, cwd, installed) {
     // codex has no --append-system-prompt; we prepend it to the prompt as
     // a "system instruction" preamble so entities still influence the run.
     const codexSystem = (0, time_context_1.appendTimeContext)(req.system_prompt);
-    const finalPrompt = `System instructions:\n${codexSystem.trim()}\n\nUser:\n${req.prompt}`;
+    // codex has no --append-system-prompt, but it reads AGENTS.md from the working
+    // directory as project guidance — the native home for an entity's system
+    // prompt, and it keeps 30K characters of persona out of the user turn. The
+    // glued form stays as the fallback when the file cannot be written (a project
+    // folder with its own AGENTS.md, a read-only disk).
+    const agentsMd = (0, codex_spawn_1.writeCodexAgentsMd)(cwd, codexSystem);
+    const finalPrompt = agentsMd
+        ? req.prompt
+        : `System instructions:\n${codexSystem.trim()}\n\nUser:\n${req.prompt}`;
     // Opportunistic reclaim right before we allocate a new scratch CODEX_HOME,
     // so a burst of runs frees space proactively rather than waiting for the
     // next periodic sweep. No-op below the high-water mark.
@@ -2081,12 +2090,7 @@ async function buildDriveManifest(installed) {
                 lines.push(`    - ${sub.name}/${f.name}`);
         }
         const body = lines.length ? lines.join('\n') : '  (empty — nothing saved yet)';
-        return [
-            '## Your +Ai Drive',
-            "You have a private +Ai Drive — file storage for working files and artifacts (documents, exports, data you produce) that survives across runs. This is for FILES, not memory: to remember facts, preferences, decisions, or what you learned, use your DocFlows memory (see below), never the Drive and never a local file. Files currently in your Drive:",
-            body,
-            "Use your +Ai Drive tools (list_files, read_file, write_file, make_folder, …) to read, add, and organise files.",
-        ].join('\n');
+        return { body, count: lines.length };
     }
     catch {
         return null;
@@ -2194,6 +2198,15 @@ async function runRequest(req) {
         }
         catch { /* keep original prompt */ }
     }
+    // Conversation-scoped context files (context/*.md) from the dispatcher: the
+    // last 50 messages, the sender, the chat. Best-effort — the inline briefing
+    // is complete without them. See context-files.ts.
+    if (req.context_files) {
+        const ctx = (0, context_files_1.writeContextFiles)(cwd, req.context_files);
+        if (ctx.skipped.length > 0) {
+            console.error(`[context-files] ${ctx.skipped.length} not written [reqId=${req.id}]: ${ctx.skipped.map(s => `${s.path} (${s.reason})`).join('; ')}`);
+        }
+    }
     // Resolve and install MCPs / skills / packages before spawn.
     const installSet = resolveInstallSet(req, resolved);
     const installed = await (0, install_1.install)(cwd, {
@@ -2218,8 +2231,18 @@ async function runRequest(req) {
     // it begins the run already aware of the files it has. All spawn paths read
     // req.system_prompt, so mutating it here reaches every agent variant.
     try {
-        const driveManifest = await buildDriveManifest(installed);
-        if (driveManifest) {
+        const drive = await buildDriveManifest(installed);
+        if (drive) {
+            const intro = "You have a private +Ai Drive — file storage for working files and artifacts (documents, exports, data you produce) that survives across runs. This is for FILES, not memory: to remember facts, preferences, decisions, or what you learned, use your DocFlows memory (see below), never the Drive and never a local file.";
+            const tools = 'Use your +Ai Drive tools (list_files, read_file, write_file, make_folder, …) to read, add, and organise files.';
+            // The listing can run to hundreds of lines and changes whenever a file
+            // does, so it lives in a file the entity reads when it needs one, and the
+            // system prompt keeps a two-line pointer that stays stable turn to turn.
+            // If the file cannot be written, the full listing goes inline as before.
+            const wrote = (0, context_files_1.writeContextFiles)(cwd, { 'context/drive.md': `# Your +Ai Drive\n\nFiles currently in your Drive:\n${drive.body}\n` }).written.length > 0;
+            const driveManifest = wrote
+                ? ['## Your +Ai Drive', intro, `Your current file list (${drive.count} entries) is in ./context/drive.md — read it when you need a file.`, tools].join('\n')
+                : ['## Your +Ai Drive', `${intro} Files currently in your Drive:`, drive.body, tools].join('\n');
             req.system_prompt =
                 req.system_prompt && req.system_prompt.trim().length > 0
                     ? `${req.system_prompt}\n\n${driveManifest}`

package/dist/tui/run.d.ts

@@ -3,17 +3,8 @@ export declare function shouldRenderTui(env: {
     stdinTTY: boolean;
     noTui: boolean;
 }): boolean;
-/** Why the console gave the terminal back. Only `quit` is the user asking
- *  to stop; the rest are the terminal being taken away underneath us. */
-export type LeaveReason = 'quit' | 'SIGHUP' | 'SIGTTIN' | 'SIGTTOU' | 'stdin-error';
-/** What giving the terminal back should cost. */
-export type LeaveAction = 
-/** Close the screen and go — nothing of ours is running here. */
-'exit'
-/** Drain the in-process daemon first, then go. */
- | 'shutdown'
-/** Close the screen and keep the daemon running headless. */
- | 'detach';
+/** What the screen does when it is leaving. */
+export type LeaveAction = 'exit' | 'shutdown' | 'detach';
 /**
  * The rule that decides whether this node survives the night.
  *
@@ -25,15 +16,15 @@ export type LeaveAction =
  *
  * Pure and exported so the rule is checkable without a TTY.
  */
-export declare function leaveAction(reason: LeaveReason, ownsDaemon: boolean): LeaveAction;
+export declare function leaveAction(reason: string, ownsDaemon: boolean): LeaveAction;
 export declare function runDashboard(opts: {
     viewerMode: boolean;
     pid: number | null;
     startedAt: number | null;
     version: string;
-    /** The in-process daemon's graceful shutdown, when this process owns one.
-     *  Its presence is also how the screen knows quitting means stopping the
-     *  node rather than closing a window onto someone else's. */
+    /** Present when the daemon runs in THIS process: how to stop it properly
+     *  when the user actually asks — and how to tell that apart from the
+     *  terminal merely disappearing. */
     stop?: () => Promise<void>;
 }): Promise<void>;
 /** `ainode harnesses` — straight to the harness screen. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addai/node",
-  "version": "0.30.10",
+  "version": "0.30.12",
   "description": "Daemon that pairs a machine with your +Ai account and runs Claude / Codex / Kimi / Gemini agents on its behalf. Reachable via Supabase from Vault, Entity Studio, or any other +Ai surface.",
   "license": "MIT",
   "keywords": [